RE: [sentinix-list] Output database

Hmm that looks like it could be it. I've also been looking at the /etc/snort/snort.conf file, 

<snip>
####################################################################
# Step #3: Configure output plugins
#
# Uncomment and configure the output plugins you decide to use.
# General configuration for output plugins is of the form:
#
# output <name_of_plugin>: <configuration_options>
#
# alert_syslog: log alerts to syslog
# ----------------------------------
# Use one or more syslog facilities as arguments
#
# output alert_syslog: LOG_AUTH LOG_ALERT

# log_tcpdump: log packets in binary tcpdump format
# -------------------------------------------------
# The only argument is the output file name.
#
# output log_tcpdump: tcpdump.log

# database: log to a variety of databases
# ---------------------------------------
# See the README.database file for more information about configuring
# and using this plugin.
#
# output database: log, mysql, user=root password=test dbname=db host=localhost
# output database: alert, postgresql, user=snort dbname=snort
# output database: log, unixodbc, user=snort dbname=snort
# output database: log, mssql, dbname=snort user=snort password=test
<snip>

It looks like this line:
output database: log, mysql, user=root password=test dbname=db host=localhost

should read:

output database: log, mysql, user=snort password=sentinix dbname=snort_db host=192.168.x.x

or something along those lines.

I'm referencing this document config settings:
http://www.andrew.cmu.edu/~rdanyliw/snort/snortdb/snortdb_config.html

Ill post back as this progresses.

Thanks,
Michael


-----Original Message-----
From: "Terkanian, Greg" <[email protected]>
Sent: Jan 7, 2004 9:32 AM
To: "M. Morgan" <[email protected]>, 
	The SENTINIX Mailing List <[email protected]>
Subject: RE: [sentinix-list] Output database

I think the file you're looking for is /usr/local/snort/snortcenter/config.php


-----Original Message-----
From: sentinix-bounces-y1CeFY8bYInMlQukkHbAVdBPR1lH4CV8@public.gmane.org
[mailto:sentinix-bounces-y1CeFY8bYInMlQukkHbAVdBPR1lH4CV8@public.gmane.org]On Behalf Of M. Morgan
Sent: Wednesday, January 07, 2004 7:56 AM
To: [email protected]
Subject: [sentinix-list] Output database


Hello all,
 I'm trying to configure a remote sensor to log into a database on a seperate server.

 Obviously I need to edit the output database config file but I cant seem to find it.

Anyone have a quick and dirty how-to or the path to the file?

here is the default line from snortcenter:

output database: alert, mysql, user=snort password=sentinix dbname=snort host=localhost port=3306 sensor_name=[AUTO]

I cant edit it in snort center though and need to reconfigure it to point to a different server.

Many thanks!

Michael
_______________________________________________
SENTINIX mailing list
[email protected]
http://elevenprospect.com/mailman/listinfo/sentinix